From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx07-00178001.pphosted.com (mx08-00178001.pphosted.com [91.207.212.93]) by sourceware.org (Postfix) with ESMTPS id 29C1F3851C31 for ; Tue, 30 Aug 2022 13:57:15 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 29C1F3851C31 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=foss.st.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=foss.st.com Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx07-00178001.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U97GkS028394 for ; Tue, 30 Aug 2022 15:57:14 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foss.st.com; h=from : to : cc : subject : date : message-id : mime-version : content-type : content-transfer-encoding; s=selector1; bh=XGs/yLYIcr3crEKj+uQuxNe0ADblYuR2lzQ7apQYidU=; b=KCaaSZ8BTsdiqnrVngyvbrWQqeehnok6xg2iwqPyFoyoUmitVbclXG9kFBsbDqfldQMB NUdmKwRU6H6JvYnPNCAS0OxqaEYWfdDYj/MbPIX+utWPavF7ZfDL9hHcKNaS7OWCJsER li9tRtziKI3VsyU5Y0vuy3e+He3Sq7AvlCBhVf6ODkUeiy6P50hEzF3ABxGNrj7JtPLF gMn9XsSxDS8EuYm4wmUjZQv0Esbjif6VWpXmTjpg0HXvJ+fcimKFSyxsflp4ZWNLROyQ HKi6AvnNnV5+3IOAoOn9+k9tCSdFkxINDV/Ym9eUwbc6bSyKTPes6nhP+Avw6flzUNQM 2A== Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com (PPS) with ESMTPS id 3j9fmy1m8e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 30 Aug 2022 15:57:14 +0200 Received: from euls16034.sgp.st.com (euls16034.sgp.st.com [10.75.44.20]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id BAF0C100034 for ; Tue, 30 Aug 2022 15:57:13 +0200 (CEST) Received: from Webmail-eu.st.com (shfdag1node3.st.com [10.75.129.71]) by euls16034.sgp.st.com (STMicroelectronics) with ESMTP id B76CB22AFFB for ; Tue, 30 Aug 2022 15:57:13 +0200 (CEST) Received: from jkgcxl0002.jkg.st.com (10.75.127.120) by SHFDAG1NODE3.st.com (10.75.129.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.2375.7; Tue, 30 Aug 2022 15:57:12 +0200 From: =?UTF-8?q?Torbj=C3=B6rn=20SVENSSON?= To: CC: =?UTF-8?q?Torbj=C3=B6rn=20SVENSSON?= Subject: [PATCH 1/2] Used chunk needs to be removed from free_list Date: Tue, 30 Aug 2022 15:56:25 +0200 Message-ID: <20220830135625.2247198-1-torbjorn.svensson@foss.st.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Originating-IP: [10.75.127.120] X-ClientProxiedBy: GPXDAG2NODE4.st.com (10.75.127.68) To SHFDAG1NODE3.st.com (10.75.129.71) X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-30_08,2022-08-30_01,2022-06-22_01 X-Spam-Status: No, score=-12.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,GIT_PATCH_0,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: When using nano malloc and the remaning heap space is not big enough to fullfill the allocation, malloc will attempt to merge the last chunk in the free list with a new allocation in order to create a bigger chunk. This is successful, but the chunk still remains in the free_list, so any later call to malloc can give out the same region without it first being freed. Possible sequence to verify: void *p1 = malloc(3000); void *p2 = malloc(4000); void *p3 = malloc(5000); void *p4 = malloc(6000); void *p5 = malloc(7000); free(p2); free(p4); void *p6 = malloc(35000); free(p6); void *p7 = malloc(42000); void *p8 = malloc(32000); Without the change, p7 and p8 points to the same address. Requirement, after malloc(35000), there is less than 42000 bytes available on the heap. Contributed by STMicroelectronics Signed-off-by: Torbjörn SVENSSON --- newlib/libc/stdlib/nano-mallocr.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c index 99ad60dd0..43eb20e07 100644 --- a/newlib/libc/stdlib/nano-mallocr.c +++ b/newlib/libc/stdlib/nano-mallocr.c @@ -336,6 +336,15 @@ void * nano_malloc(RARG malloc_size_t s) if (sbrk_aligned(RCALL alloc_size) != (void *)-1) { p->size += alloc_size; + + /* Remove chunk from free_list */ + r = free_list; + while (r && p != r->next) + { + r = r->next; + } + r->next = NULL; + r = p; } else -- 2.25.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx07-00178001.pphosted.com (mx08-00178001.pphosted.com [91.207.212.93]) by sourceware.org (Postfix) with ESMTPS id 29C1F3851C31 for ; Tue, 30 Aug 2022 13:57:15 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 29C1F3851C31 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=foss.st.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=foss.st.com Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx07-00178001.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U97GkS028394 for ; Tue, 30 Aug 2022 15:57:14 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foss.st.com; h=from : to : cc : subject : date : message-id : mime-version : content-type : content-transfer-encoding; s=selector1; bh=XGs/yLYIcr3crEKj+uQuxNe0ADblYuR2lzQ7apQYidU=; b=KCaaSZ8BTsdiqnrVngyvbrWQqeehnok6xg2iwqPyFoyoUmitVbclXG9kFBsbDqfldQMB NUdmKwRU6H6JvYnPNCAS0OxqaEYWfdDYj/MbPIX+utWPavF7ZfDL9hHcKNaS7OWCJsER li9tRtziKI3VsyU5Y0vuy3e+He3Sq7AvlCBhVf6ODkUeiy6P50hEzF3ABxGNrj7JtPLF gMn9XsSxDS8EuYm4wmUjZQv0Esbjif6VWpXmTjpg0HXvJ+fcimKFSyxsflp4ZWNLROyQ HKi6AvnNnV5+3IOAoOn9+k9tCSdFkxINDV/Ym9eUwbc6bSyKTPes6nhP+Avw6flzUNQM 2A== Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com (PPS) with ESMTPS id 3j9fmy1m8e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 30 Aug 2022 15:57:14 +0200 Received: from euls16034.sgp.st.com (euls16034.sgp.st.com [10.75.44.20]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id BAF0C100034 for ; Tue, 30 Aug 2022 15:57:13 +0200 (CEST) Received: from Webmail-eu.st.com (shfdag1node3.st.com [10.75.129.71]) by euls16034.sgp.st.com (STMicroelectronics) with ESMTP id B76CB22AFFB for ; Tue, 30 Aug 2022 15:57:13 +0200 (CEST) Received: from jkgcxl0002.jkg.st.com (10.75.127.120) by SHFDAG1NODE3.st.com (10.75.129.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.2375.7; Tue, 30 Aug 2022 15:57:12 +0200 From: =?UTF-8?q?Torbj=C3=B6rn=20SVENSSON?= To: Subject: [PATCH 1/2] Used chunk needs to be removed from free_list Date: Tue, 30 Aug 2022 15:56:25 +0200 Message-ID: <20220830135625.2247198-1-torbjorn.svensson@foss.st.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Originating-IP: [10.75.127.120] X-ClientProxiedBy: GPXDAG2NODE4.st.com (10.75.127.68) To SHFDAG1NODE3.st.com (10.75.129.71) X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-30_08,2022-08-30_01,2022-06-22_01 X-Spam-Status: No, score=-12.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, GIT_PATCH_0, RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: newlib@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Newlib mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Aug 2022 13:57:19 -0000 Message-ID: <20220830135625.4kzESCVUBopSppIzQGGRdSumBGZ8pnNBaRB87yZtrwU@z> When using nano malloc and the remaning heap space is not big enough to fullfill the allocation, malloc will attempt to merge the last chunk in the free list with a new allocation in order to create a bigger chunk. This is successful, but the chunk still remains in the free_list, so any later call to malloc can give out the same region without it first being freed. Possible sequence to verify: void *p1 = malloc(3000); void *p2 = malloc(4000); void *p3 = malloc(5000); void *p4 = malloc(6000); void *p5 = malloc(7000); free(p2); free(p4); void *p6 = malloc(35000); free(p6); void *p7 = malloc(42000); void *p8 = malloc(32000); Without the change, p7 and p8 points to the same address. Requirement, after malloc(35000), there is less than 42000 bytes available on the heap. Contributed by STMicroelectronics Signed-off-by: Torbjörn SVENSSON --- newlib/libc/stdlib/nano-mallocr.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c index 99ad60dd0..43eb20e07 100644 --- a/newlib/libc/stdlib/nano-mallocr.c +++ b/newlib/libc/stdlib/nano-mallocr.c @@ -336,6 +336,15 @@ void * nano_malloc(RARG malloc_size_t s) if (sbrk_aligned(RCALL alloc_size) != (void *)-1) { p->size += alloc_size; + + /* Remove chunk from free_list */ + r = free_list; + while (r && p != r->next) + { + r = r->next; + } + r->next = NULL; + r = p; } else -- 2.25.1